fields in sourcetype1 --> A,B,C, txid ( always has a value)
fields in sourcetype2--> D,E,F, txid ( may occur value for some sources or may not)
Its clear that i have a common field ( txid) in two different sourcetypes sourcetype1 and sourcetype2
Requirement:
I need to print A,B from sourcetype1, in case i didnt find "txid" in sourcetype2,
Please help
How about
sourcetype=sourcetype1 OR sourcetype=sourcetype2
| stats values(A) as A values(B) as B values(sourcetype) as types by txid
| where mvcount(types)==1 AND isnull(mvfind(types,"sourcetype2"))
| table A B txid